Imagine walking into the sweltering heat after being in an air-conditioned room and your eyewear becomes incredibly foggy with condensation. Using the tail of your shirt, glasses are cleaned and repositioned on the eyes. Voila! Operations resume. Since the Consumer Federal Protection Bureau’s (CFPB) formation, the Unfair, Deceptive, or Abusive Acts and Practices (UDAAP) journey reminds me of walking out of the air conditioning and into the heat over and over due to vague guidance and mixed signals from the agency that are followed by moments of clarity.
Understanding the UDAAP Evolution
Let’s travel down memory lane. In 1938, Section 5 of the Federal Trade Commission (FTC) Act made it official that consumers deserve the right to be treated fairly when engaging in commerce across all industries. Sixty-six years later, the acronym “UDAP” was born, and the FTC used its authority to act on companies that treated consumers unfairly or deceptively.
When Congress passed the Dodd Frank Act and the CFPB was formed in 2010, the banking industry became more up close and personal with UDAP when enforcement of its violations and rulemaking transitioned from the FTC to the CFPB. The agency’s first line of business was the introduction of the “abusive” prong, which expanded the acronym to UDAAP. For those of us serving in the industry in 2011, UDAAP was the buzzword, and banks braced for impact in response to what was and is still described as a very vague regulation. Training, policies, and risk assessments were implemented, and some banks named a “UDAAP Officer.” Enforcement actions were taken under the director of the CFPB from 2012–2017 when authority was used to act on conduct that, until that time, no one knew was illegal, hence the popular “We know UDAAP when we see it” phrase. When a new administration took office in Washington in 2017, the CFPB loosened its reigns, and UDAAP enforcement declined under new directors and orders from the White House. In 2020, the acting director defined abusive in a Policy Statement which relieved institutions from civil penalties if good faith efforts to comply with the law were demonstrated. That Policy Statement was quickly rescinded when a new administration took office in 2021. UDAAP conversations regained momentum in public speeches, and the President signed an Executive Order (EO) encouraging the CFPB to revive enforcement of the law.
UDAAP Today
Since the EO and the permanent appointment of a new director, the CFPB’s UDAAP Examination Procedures manual was updated to reflect a commitment to enforcement upon industry players accused of being unfair, deceptive, or abusive to consumers. A UDAAP violation is independent of other regulatory violations, and the CFPB has made it very clear that discrimination associated with any financial product, not just credit, is illegal. This includes deposit accounts, payments, and debt collections expanding further to include marketing, incentive programs, and any area of operations. The CFPB has publicly stated it will crack down on violations in home loans and small business loans. Even lending decisions using artificial intelligence and machine learning will be evaluated for UDAAP violations.
Managing UDAAP Risk During Times of Uncertainty
Although the UDAAP journey has provided both haze and clarity, success is achieved by continually wearing the UDAAP lens. Considering UDAAP at all stages of product evolution and throughout a consumer’s entire banking journey with your institution is key. From the first introduction of your brand and offerings through marketing and advertising to the loan collections process and beyond, understand each area’s susceptibility to UDAAP risk.
A stand-alone UDAAP risk assessment is not required, but consideration should be incorporated in all risk assessments, such as Fair Lending, Product and Services Development, Vendor Management, and others unique to your institution.
Educate the team and encourage them to speak up when something is confusing or unclear. Often those who are implementing strategy, marketing, lending programs, and policies are not doing so with malicious intent. It’s similar to having someone else proofread a document; the writer of the document becomes blind at times to grammatical errors because of prolonged exposure to the words.
Create a policy, and take the time to educate the Board of Directors on potential red flags or areas most susceptible to UDAAP claims. Learn from others. While several recent UDAAP consent orders were imposed on non-traditional lenders or “big banks,” being attentive to these actions will only enhance your knowledge of how the regulators are thinking. Review your processes, looking for similarities to the accused. Avoid an “it can’t happen to us” attitude.
Most importantly, ask the difficult questions around whether products, marketing, disclosures, lending, etc. could be perceived as harmful to consumers and dedicate resources to a robust complaint management system to aid in the early detection of issues that could heighten UDAAP risk. Building a reputation and brand takes years of dedicated effort, and one UDAAP claim, even if disputable or unwarranted, can wreak havoc on all preceding success. Adjust them when necessary, but keep your UDAAP lens well-positioned and clear.
